Overview

Welcome to the Event Scavenger project pages. This set of tools provide you with the means gather the contents of Windows Event logs and to do enhanced reporting and analysis on the data. It source the event logs automatically using polling services called Reapers.The system is also self maintaining and does automatic cleanups of old data based on criteria you specify.

Version 5

A new version is out! Some of the new changes are:

- Totally new collector service (now called Reaper) with host of new features.
  Less resource usage - no more lots of idle threads.
  Multi-instance - multiple copies of the Reaper service can be run on the same machine side-by-side.
  Previous version Collector can also run side by side with new version.

- Admin tool now includes a number of ways to manage the Reapers directly.
  Users can be managed from the tool
  Reaper services can be managed (stop/start/pause/continue) from the tool.
  Setting up new Reaper service instance from Admin tool (not fully automated yet)

Version 5 (stable) can now be downloaded from this site.

Components

Event Scavenger consists of the following parts:

  • SQL Server Database - The database has a fairly simple structure that hold all the necessary data.
  • Reaper services - This is a Windows service that gathers specified event logs and store the data in the database. One instance of the service is also responsible for maintenance of the system - like archiving and deleting old data.  It can also imports log entries stored in other Event Scavenger databases and copy those its own database. The system allows for multiple reapers to populate a single database.
  • Admin tool - This is a simple Windows application to managed the database and settings.
  • Viewer - This is a Windows application that is the main front end of the system. It has some powerful filtering and searching capabilities. It also allows you to analyze data using a special grouping control to give an aggregated view of data. Additionally it can export data for further analysis in an application like Excel for creating graphs etc.

EventScavengercomponents

Benefits

There are multiple benefits of using Event Scavenger over just viewing plain old event logs.

  • Provides a consolidated view of events over multiple machines
  • Filtering data quickly and easily - on the fly.
  • Allows for advanced reporting on the data
  • Store the data longer based on requirements
  • Eliminate the need to give multiple people (developers/users) access to event logs directly. (yes, it could be a con as well - plan for it properly by using the sql server roles designed for this)

Viewer

The viewer gives you a view of all selected 'machine-logs' at a specified time. It provides several ways to filter and/or highlight data. You can also set up predefined views that specify a set of filters for reuse. There is also a top x filter that can be changed that limit the number of records returned from the database.


EventScavengerViewer.jpg

Filters

The application allows you to filter data by event type, machine-logs, event sources, event id's, from and to date/time and also text inside an event log message. Additionally you can set a filter based on currently selected entries (like 'only show similar' or 'exclude entries like these'). You can also save the current set of filters to a new view for reuse.
The machine-log, event sources and event id filters are 'multi-aware' meaning multiples of them can be selected at the same time to filter the data. The main window allows for the names of machine-logs, event sources and event id's to be typed in manually to quickly filter entries.

Highlighting

Entries can also be highlighted based on machine-log, event-sources and/or event id's. This makes it easier to spot similar entries.

Grouping

As from version 3.3.0 the viewer supports grouping the results shown. This is useful for finding related entries more quickly. Collapsing and expanding the groups are supported as well under Vista and Windows 7 (and onwards) - the reason is that the ListView control from earlier versions of Windows does not support this functionality.
Grouping can be done on the following fields:

  • Machine name
  • Log name
  • Type
  • Source
  • Event ID
  • Month
  • Day
  • Hour
  • Summary

Exports

The application allows for exporting selected or all data currently displayed to csv format. This can then analyzed further in Excel to create graphs or summary data for reports.

Analyze data

A customized list control allows for viewing data in a summarized view. It allows for dragging and dropping of columns and group by fields.
EventScavengerViewerAnalysis.jpg
Credit: I use an old customized version of http://superlist.codeplex.com for this.
From version 3.4 of the Viewer you can get a simple pie chart view of the displayed data.
PieChart.jpg

Auto refresh

The application can be set up to automatically refresh if needed. This is useful if you need to wait for some events to happen.

Command line query tool

[This tool was part of the product before version 5] The command line query tool takes the following parameters:
ELSQueryCMD.jpg

Stability

This is one very strong point that has a proven track record. Instances of the (original) collector service has been running for up to 5 years - sometimes months continuously and the only reason it had to be restarted was because something else on the server required a restart. It is actually in use in a production environment and used by real people.

Alerting

Event Scavenger on its own does not do any processing on the captured event log data it gathers - i.e. it does not have the ability to raise alerts or notify someone if it reads an 'Error' or 'Warning' event log entry. The main aim for this tool is gathering, storing and then reporting of the data through the UI tools.

However, I have another tool/project called QuickMon that does general monitoring/alerting. It has a SQL Query Collector that can raise alerts/notifications (i.e. email) if the sql query returns a specified value. Using a combination of Event Scavenger plus QuickMon then allows you to raise alerts/notifications based on data captured from event logs.

Last edited Aug 16, 2013 at 8:37 AM by RudolfHenning, version 59